Security Bulletin: IBM Security Guardium is aware of a GnuTLS vulnerability

Summary

IBM Security Guardium is aware of the following vulnerabilities

Vulnerability Details

CVE-2018-10846, CVE-2018-10845, CVE-2018-10844

Affected Products and Versions

Affected IBM Security Guardium

|

Affected Versions

—|—
IBM Security Guardium | 9 - 9.5
IBM Security Guardium | 10 - 10.5

Remediation/Fixes

Product

|

VRMF

|

Remediation / First Fix

—|—|—
IBM Security Guardium | 9-9.5 | N/A
IBM Security Guardium | 10-10.5 | N/A

Workarounds and Mitigations

IBM Security Guardium is aware of these GnuTLS vulnerabilities. These vulnerabilities exist in a 3rd party component which IBM Security Guardium consumes. The 3rd party vendor has indicated that they will not be fixing the versions of the component that IBM consumes in IBM Security Guardium versions.

IBM suggests that customers using the Remote Syslog feature of the IBM Security Guardium appliance ensure that their Remote Syslog servers are at the latest kernel patch levels to mitigate any possible risk from these vulnerabilities.